Method for preventing storage of prohibited data on an Ad Hoc moving data network

ABSTRACT

The present disclosure provides a method operable in a balloon network. The method can include determining that a balloon is at a location associated with a first legally-defined geographic area, wherein an area profile identifies a list of geographically-prohibited data that is restricted from being cached in the first legally-defined geographic area. The method can also include receiving first data. The method can also include using the list of geographically-prohibited data to determine whether or not the first data is geographically-prohibited data. If the first data is geographically-prohibited data, then the method can further include refraining from storing the first data in data storage at the first balloon.

BACKGROUND

Unless otherwise indicated herein, the materials described in thissection are not prior art to the claims in this application and are notadmitted to be prior art by inclusion in this section.

Computing devices such as personal computers, laptop computers, tabletcomputers, cellular phones, and countless types of Internet-capabledevices are increasingly prevalent in numerous aspects of modern life.As such, the demand for data connectivity via the Internet, cellulardata networks, and other such networks, is growing. However, there aremany areas of the world where data connectivity is still unavailable, orif available, is unreliable and/or costly. Accordingly, additionalnetwork infrastructure is desirable.

SUMMARY

In one aspect, the present disclosure provides a computer-implementedmethod. The method can include determining that a balloon is at alocation associated with a first legally-defined geographic area,wherein an area profile identifies a list of geographically-prohibiteddata that is restricted from being cached in the first legally-definedgeographic area. The method can also include receiving first data. Themethod can also include using the list of geographically-prohibited datato determine whether or not the first data is geographically-prohibiteddata. If the first data is geographically-prohibited data, then themethod can further include refraining from storing the first data indata storage at the first balloon.

In another aspect, the present disclosure provides acomputer-implemented method. The method can include determining that aballoon is at a location associated with a first legally-definedgeographic area, wherein an area profile indicates, for each of one ormore second legally-defined geographic areas, a list ofgeographically-prohibited data that is restricted from being cached inthe respective second legally-defined geographic area. The method canalso include receiving first data. The method can also include using thelist of geographically-prohibited data for at least one of the secondlegally-defined geographic areas to determine whether or not the firstdata is geographically-prohibited data in the at least one of the secondlegally-defined geographic area. The method can also include routing thefirst data towards a destination based on the determination as towhether or not the first data is geographically-prohibited.

In yet another aspect, the present disclosure provides acomputer-readable medium storing instructions that, when executed by oneor more processors in a computing device, cause the computing device toperform functions. The functions can include determining that a balloonis at a location associated with a first legally-defined geographicarea. The functions can also include receiving first data. The functionscan also include using a list of geographically-prohibited data todetermine whether or not the first data is geographically-prohibiteddata, wherein geographically-prohibited data is restricted from beingcached in the first legally-defined geographic area. If the first datais geographically-prohibited data, then the functions can also includerefraining from storing the first data in data storage at the firstballoon.

In yet another aspect, the present disclosure provides a ballooncomprising a location determination system configured to determine alocation of the balloon, a communication interface configured to receivefirst data, and a control system. The control system can be configuredto determine that the balloon is at a location associated with a firstlegally-defined geographic area, wherein an area profile identifies alist of geographically-prohibited data that is restricted from beingcached in the first legally-defined geographic area. The control systemcan also be configured to use the list of geographically-prohibited datato determine whether or not the first data is geographically-prohibiteddata. If the first data is geographically-prohibited data, then thecontrol system can further be configured to refrain from storing thefirst data in data storage at the first balloon.

In yet another aspect, the present disclosure provides a ballooncomprising a location determination system configured to determine alocation of the balloon, a communication interface configured to receivefirst data, and a control system. The control system can be configuredto determine that the balloon is at a location associated with a firstlegally-defined geographic area, wherein an area profile indicates, foreach of one or more second legally-defined geographic areas, a list ofgeographically-prohibited data that is restricted from being cached inthe respective second legally-defined geographic area. The controlsystem can also be configured to use the list ofgeographically-prohibited data for at least one of the secondlegally-defined geographic areas to determine whether or not the firstdata is geographically-prohibited data in the at least one of the secondlegally-defined geographic area. The control system can also beconfigured to route the first data towards a destination based on thedetermination as to whether or not the first data isgeographically-prohibited.

These as well as other aspects, advantages, and alternatives, willbecome apparent to those of ordinary skill in the art by reading thefollowing detailed description, with reference where appropriate to theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a simplified block diagram illustrating a balloon network,according to an exemplary embodiment.

FIG. 2 is a block diagram illustrating a balloon-network control system,according to an exemplary embodiment.

FIG. 3 shows a high-altitude balloon, according to an exemplaryembodiment.

FIG. 4 is a simplified block diagram illustrating a balloon network thatincludes super-nodes and sub-nodes, according to an exemplaryembodiment.

FIG. 5 is a simplified flow chart illustrating a method, according to anexemplary embodiment.

FIG. 6 is a simplified flow chart illustrating a method, according to anexemplary embodiment.

FIG. 7 depicts a computer-readable medium configured according to anexample embodiment.

DETAILED DESCRIPTION

Exemplary methods and systems are described herein. It should beunderstood that the word “exemplary” is used herein to mean “serving asan example, instance, or illustration.” Any embodiment or featuredescribed herein as “exemplary” is not necessarily to be construed aspreferred or advantageous over other embodiments or features. Theexemplary embodiments described herein are not meant to be limiting. Itwill be readily understood that certain aspects of the disclosed systemsand methods can be arranged and combined in a wide variety of differentconfigurations, all of which are contemplated herein.

Furthermore, the particular arrangements shown in the Figures should notbe viewed as limiting. It should be understood that other embodimentsmay include more or less of each element shown in a given Figure.Further, some of the illustrated elements may be combined or omitted.Yet further, an exemplary embodiment may include elements that are notillustrated in the Figures.

I. Overview

Exemplary embodiments may generally relate to a data network formed byballoons, and in particular, to a mesh network formed by high-altitudeballoons deployed in the stratosphere. In order that the balloons canprovide a reliable mesh network in the stratosphere, where winds mayaffect the locations of the various balloons in an asymmetrical manner,the balloons in an exemplary network may be configured movelatitudinally and/or longitudinally relative to one another by adjustingtheir respective altitudes, such that the wind carries the respectiveballoons to the respectively desired locations.

Further, in an exemplary balloon network, the balloons may communicatewith one another using free-space optical communications. For instance,the balloons may be configured for optical communications using lasersand/or ultrabright LEDs or lasers for optical signaling. In addition,the balloons may communicate with ground-based station(s) usingradio-frequency (RF) communications.

In an exemplary balloon network, the balloons are free to move from onelegally-defined geographic area to another. A legally-defined geographicarea can be a country, state, city, an area defined by internationallaw, or even an area defined by some more temporary measure (e.g., a“disaster area” or “no-fly zone” as defined periodically by the U.S.government).

Each legally-defined geographic area may have its own laws that specifywhether certain data or types of data cannot be physically brought intoand/or stored (e.g., cached) in that area. Herein, data that isprohibited from being brought into and/or stored in a givenlegally-defined geographic area may be referred to asgeographically-prohibited data for the legally-defined geographic area.

Almost any type of data may be geographically prohibited in a givenlegally-defined geographic area, depending upon the laws and regulationsof the given legally-defined geographic area. For example, certain typesof user data may be geographically prohibited. As another example,certain types or classes of data may be prohibited in a certainlegally-defined geographic area. As a specific example, explicit adultmaterial might be prohibited in a given legally-defined geographic area.As yet another specific example, a law in the country of Turkey mightprohibit caching of a video that defames a Turk. Many other specificexamples of types of data that can be geographically prohibited are alsopossible as well.

As a balloon network may span over multiple legally-defined geographicareas (e.g., over a number of countries), each balloon in the balloonnetwork may move between different legally-defined geographic areas. Assuch, it is desirable for a balloon in the balloon network todynamically adjust to the laws of whichever legally-defined geographicarea the balloon is located in at any given time.

For instance, consider a balloon that is positioned over China, wherethere may be a law prohibiting caching of data content that originatedfrom a certain first data source (e.g., from a particular server). Whilepositioned over China, a balloon may receive data originating from aprohibited server. Using a list of geographically-prohibited data (inthis case, the list would include data originating from a prohibitedserver), the balloon can determine that the data isgeographically-prohibited data. The balloon may then responsivelyrefrain from storing the data in data storage at the balloon. Otherexamples are also possible.

However, the balloon may not remain in China. For instance, the balloonmight move into Turkey, where there is no law prohibiting content fromthe first data source, but where there is a law prohibiting certainexplicit adult material. Accordingly, the balloon may update itssettings so that it operates in accord with the laws of Turkey. As such,the balloon will no longer treat content from the first data source asgeographically-prohibited data, and thus may cache data content from thefirst data source. However, the balloon may update its setting so as todetect and treat explicit adult material as geographically-prohibiteddata, so long as the balloon is providing service in Turkey.

It should be understood that the above examples of the method areprovided for illustrative purposes, and should not be construed aslimiting. As such, the method additionally or alternatively includesother steps or includes fewer steps, without departing from the scope ofthe invention.

II. Exemplary Balloon Networks

In some embodiments, a high-altitude-balloon network may be homogenous.More specifically, in a homogenous high-altitude-balloon network, eachballoon is configured to communicate with nearby balloons via free-spaceoptical links. Further, some or all of the balloons in such a network,may also be configured communicate with ground-based station(s) using RFcommunications. (Note that in some embodiments, the balloons may behomogenous in so far as each balloon is configured for free-spaceoptical communication with other balloons, but heterogeneous with regardto RF communications with ground-based stations.)

In other embodiments, a high-altitude-balloon network may beheterogeneous, and thus may include two or more different types ofballoons. For example, some balloons may be configured as super-nodes,while other balloons may be configured as sub-nodes. (Note also thatsome balloons may be configured to function as both a super-node and asub-node.)

In such a configuration, the super-node balloons may be configured tocommunicate with nearby super-node balloons via free-space opticallinks. However, the sub-node balloons may not be configured forfree-space optical communication, and may instead be configured for,e.g., RF communications. Accordingly, a super-node may be furtherconfigured to communicate with nearby sub-nodes using RF communications.The sub-nodes may accordingly relay communications from the super-nodesto ground-based station(s) using RF communications. Configured as such,the super-nodes may collectively function as backhaul for the balloonnetwork, while the sub-nodes function to relay communications from thesuper-nodes to ground-based stations.

FIG. 1 is a simplified block diagram illustrating a balloon network 100,according to an exemplary embodiment. As shown, balloon network 100includes balloons 102A to 102E, which are configured to communicate withone another via free-space optical links 104. Configured as such,balloons 102A to 102E may collectively function as a mesh network forpacket-data communications. Further, balloons 102A to 102D may beconfigured for RF communications with ground-based stations 106 via RFlinks 108.

In an exemplary embodiment, balloons 102A to 102E are high-altitudeballoons, which are deployed in the stratosphere. At moderate latitudes,the stratosphere includes altitudes between approximately 10 kilometers(km) and 50 km altitude above the surface. At the poles, thestratosphere starts at an altitude of approximately 8 km. In anexemplary embodiment, high-altitude balloons may be generally configuredto operate in an altitude range within the stratosphere that has lowerwinds (e.g., between 5 and 20 miles per hour (mph)).

More specifically, in a high-altitude-balloon network, balloons 102A to102E may generally be configured to operate at altitudes between 17 kmand 22 km (although other altitudes are possible). This altitude rangemay be advantageous for several reasons. In particular, this layer ofthe stratosphere generally has mild wind and turbulence (e.g., windsbetween 5 and 20 miles per hour (mph)). Further, while the winds between17 km and 22 km may vary with latitude and by season, the variations canbe modeled in a reasonably accurate manner. Additionally, altitudesabove 17 km are typically above the maximum flight level designated forcommercial air traffic. Therefore, interference with commercial flightsis not a concern when balloons are deployed between 17 km and 22 km.

To transmit data to another balloon, a given balloon 102A to 102E may beconfigured to transmit an optical signal via an optical link 104. In anexemplary embodiment, a given balloon 102A to 102E may use one or morehigh-power light-emitting diodes (LEDs) to transmit an optical signal.Alternatively, some or all of balloons 102A to 102E may include lasersystems for free-space optical communications over optical links 104.Other types of free-space optical communication are possible. Further,in order to receive an optical signal from another balloon via anoptical link 104, a given balloon 102A to 102E may include one or moreoptical receivers. Additional details of exemplary balloons arediscussed in greater detail below, with reference to FIG. 3.

In a further aspect, balloons 102A to 102D may utilize one or more ofvarious different RF air-interface protocols for communicationground-based stations 106 via RF links 108. For instance, some or all ofballoons 102A to 102D may be configured to communicate with ground-basedstations 106 using protocols described in IEEE 802.11 (including any ofthe IEEE 802.11 revisions), various cellular protocols such as GSM,CDMA, UMTS, EV-DO, WiMAX, and/or LTE, and/or one or more proprietyprotocols developed for balloon-to-ground RF communication, among otherpossibilities.

In a further aspect, there may scenarios where RF links 108 do notprovide a desired link capacity for balloon-to-ground communications.For instance, increased capacity may be desirable to provide backhaullinks from a ground-based gateway, and in other scenarios as well.Accordingly, an exemplary network may also include downlink balloons,which provide a high-capacity air-to-ground link.

For example, in balloon network 100, balloon 102E is configured as adownlink balloon. Like other balloons in an exemplary network, adownlink balloon 102E may be operable for optical communication withother balloons via optical links 104. However, a downlink balloon 102Emay also be configured for free-space optical communication with aground-based station 112 via an optical link 110. Optical link 110 maytherefore serve as a high-capacity link (as compared to an RF link 108)between the balloon network 100 and a ground-based station 108.

Note that in some implementations, a downlink balloon 102E mayadditionally be operable for RF communication with ground-based stations106. In other cases, a downlink balloon 102E may only use an opticallink for balloon-to-ground communications. Further, while thearrangement shown in FIG. 1 includes just one downlink balloon 102E, anexemplary balloon network can also include multiple downlink balloons.On the other hand, a balloon network can also be implemented without anydownlink balloons.

In other implementations, a downlink balloon may be equipped with aspecialized, high-bandwidth RF communication system forballoon-to-ground communications, instead of or in addition to afree-space optical communication system. The high-bandwidth RFcommunication system may take the form of an ultra-wideband system,which provides an RF link with substantially the same capacity as theoptical links 104. Other forms are also possible.

Ground-based stations, such as ground-based stations 106 and/or 108, maytake various forms. Generally, a ground-based station may includecomponents such as transceivers, transmitters, and/or receivers forcommunication via RF links and/or optical links with a balloon network.Further, a ground-based station may use various air-interface protocolsin order communicate with a balloon 102A to 102E over an RF link 108. Assuch, a ground-based station 106 may be configured as an access pointsvia which various devices can connect to balloon network 100.Ground-based stations 106 may have other configurations and/or serveother purposes without departing from the scope of the invention.

Further, some ground-based stations, such as ground-based station 108,may be configured as gateways between balloon network 100 and one ormore other networks. Such a ground-based station 108 may thus serve asan interface between the balloon network and the Internet, a cellularservice provider's network, and/or other types of networks. Variationson this configuration and other configurations of a ground-based station108 are also possible.

A. Mesh-Network Functionality

As noted, balloons 102A to 102E may collectively function as a meshnetwork. More specifically, since balloons 102A to 102E may communicatewith one another using free-space optical links, the balloons maycollectively function as a free-space optical mesh network.

In a mesh-network configuration, each balloon 102A to 102E may functionas a node of the mesh network, which is operable to receive data directto it and to route data to other balloons. As such, data may be routedfrom a source balloon to a destination balloon by determining anappropriate sequence of optical links between the source balloon and thedestination balloon. These optical links may be collectively referred toas a “lightpath” for the connection between the source and destinationballoons. Further, each of the optical links may be referred to as a“hop” on the lightpath.

Further, in order to operate as a mesh network, balloons 102A to 102Emay employ various routing techniques and self-healing algorithms. Insome embodiments, a balloon network 100 may employ adaptive or dynamicrouting, where a lightpath between a source and destination balloon isdetermined and set-up when the connection is needed, and released at alater time. Further, when adaptive routing is used, the lightpath may bedetermined dynamically depending upon the current state, past state,and/or predicted state of the balloon network.

In addition, the network topology may change as the balloons 102A to102E move relative to one another and/or relative to the ground.Accordingly, an exemplary balloon network 100 may apply a mesh protocolto update the state of the network as the topology of the networkchanges. For example, to address the mobility of the balloons 102A to102E, balloon network 100 may employ and/or adapt various techniquesthat are employed in mobile ad hoc networks (MANETs). Other examples arepossible as well.

In some implementations, a balloon network 100 may be configured as atransparent mesh network. More specifically, in a transparent balloonnetwork, the balloons may include components for physical switching thatis entirely optical, without any electrical involved in physical routingof optical signals. Thus, in a transparent configuration with opticalswitching, signals travel through a multi-hop lightpath that is entirelyoptical.

In other implementations, the balloon network 100 may implement afree-space optical mesh network that is opaque. In an opaqueconfiguration, some or all balloons 102A to 102E may implementoptical-electrical-optical (OEO) switching. For example, some or allballoons may include optical cross-connects (OXCs) for OEO conversion ofoptical signals. Other opaque configurations are also possible.

In a further aspect, balloons in an exemplary balloon network 100 mayimplement wavelength division multiplexing (WDM), which may help toincrease link capacity. When WDM is implemented with transparentswitching, physical lightpaths through the balloon network may besubject to the “wavelength continuity constraint.” More specifically,because the switching in a transparent network is entirely optical, itmay be necessary to assign the same wavelength for all optical links ona given lightpath.

An opaque configuration, on the other hand, may avoid the wavelengthcontinuity constraint. In particular, balloons in an opaque balloonnetwork may include the OEO switching systems operable for wavelengthconversion. As a result, balloons can convert the wavelength of anoptical signal at each hop along a lightpath.

Further, various routing algorithms may be employed in an opaqueconfiguration. For example, to determine a primary lightpath and/or oneor more diverse backup lightpaths for a given connection, exemplaryballoons may apply or consider shortest-path routing techniques such asDijkstra's algorithm and k-shortest path, and/or edge and node-diverseor disjoint routing such as Suurballe's algorithm, among others.Additionally or alternatively, techniques for improving QoS may beemployed when determining a lightpath. Other techniques are alsopossible.

B. Station-Keeping Functionality

In an exemplary embodiment, a balloon network 100 may implementstation-keeping functions to help provide a desired network topology.For example, station-keeping may involve each balloon 102A to 102Emaintaining and/or moving into a certain position relative to one ormore other balloons in the network (and possibly in a certain positionrelative to the ground). As part of this process, each balloon 102A to102E may implement station-keeping functions to determine its desiredpositioning within the desired topology, and if necessary, to determinehow to move to the desired position.

The desired topology may vary depending upon the particularimplementation. In some cases, balloons may implement station-keeping toprovide a substantially uniform topology. In such case, a given balloon102A to 102E may implement station-keeping functions to position itselfat substantially the same distance (or within a certain range ofdistances) from adjacent balloons in the balloon network 100.

In other cases, a balloon network 100 may have a non-uniform topology.For instance, exemplary embodiments may involve topologies whereballoons area distributed more or less densely in certain areas, forvarious reasons. As an example, to help meet the higher bandwidthdemands that are typical in urban areas, balloons may be clustered moredensely over urban areas. For similar reasons, the distribution ofballoons may be denser over land than over large bodies of water. Manyother examples of non-uniform topologies are possible.

In a further aspect, the topology of an exemplary balloon network may beadaptable. In particular, station-keeping functionality of exemplaryballoons may allow the balloons to adjust their respective positioningin accordance with a change in the desired topology of the network. Forexample, one or more balloons could move to new positions to increase ordecrease the density of balloons in a given area.

In some embodiments, a balloon network 100 may employ an energy functionto determine if and/or how balloons should move to provide a desiredtopology. In particular, the state of a given balloon and the states ofsome or all nearby balloons may be input to an energy function. Theenergy function may apply the current states of the given balloon andthe nearby balloons to a desired network state (e.g., a statecorresponding to the desired topology). A vector indicating a desiredmovement of the given balloon may then be determined by determining thegradient of the energy function. The given balloon may then determineappropriate actions to take in order to effectuate the desired movement.For example, a balloon may determine an altitude adjustment oradjustments such that winds will move the balloon in the desired manner.

C. Control of Balloons in a Balloon Network

In some embodiments, mesh networking and/or station-keeping functionsmay be centralized. For example, FIG. 2 is a block diagram illustratinga balloon-network control system, according to an exemplary embodiment.In particular, FIG. 2 shows a distributed control system, which includesa central control system 200 and a number of regional control-systems202A to 202B. Such a control system may be configured to coordinatecertain functionality for balloon network 204, and as such, may beconfigured to control and/or coordinate certain functions for balloons206A to 206I.

In the illustrated embodiment, central control system 200 may beconfigured to communicate with balloons 206A to 206I via number ofregional control systems 202A to 202C. These regional control systems202A to 202C may be configured to receive communications and/oraggregate data from balloons in the respective geographic areas thatthey cover, and to relay the communications and/or data to centralcontrol system 200. Further, regional control systems 202A to 202C maybe configured to route communications from central control system 200 tothe balloons in their respective geographic areas. For instance, asshown in FIG. 2, regional control system 202A may relay communicationsand/or data between balloons 206A to 206C and central control system200, regional control system 202B may relay communications and/or databetween balloons 206D to 206F and central control system 200, andregional control system 202C may relay communications and/or databetween balloons 206G to 206I and central control system 200.

In order to facilitate communications between the central control system200 and balloons 206A to 206I, certain balloons may be configured asdownlink balloons, which are operable to communicate with regionalcontrol systems 202A to 202C. Accordingly, each regional control system202A to 202C may be configured to communicate with the downlink balloonor balloons in the respective geographic area it covers. For example, inthe illustrated embodiment, balloons 204A, 204D, and 204H are configuredas downlink balloons. As such, regional control systems 202A to 202C mayrespectively communicate with balloons 204A, 204D, and 204H via opticallinks 206, 208, and 210, respectively.

In the illustrated configuration, where only some of balloons 206A to206I are configured as downlink balloons, the balloons 206A, 206D, and206H that are configured as downlink balloons may function to relaycommunications from central control system 200 to other balloons in theballoon network, such as balloons 206B, 206C, 206E to 206G, and 206I.However, it should be understood that it in some implementations, it ispossible that all balloons may function as downlink balloons. Further,while FIG. 2 shows multiple balloons configured as downlink balloons, itis also possible for a balloon network to include only one downlinkballoon.

Note that a regional control system 202A to 202B may in fact just beparticular type of ground-based station that is configured tocommunicate with downlink balloons (e.g., such as ground-based station112 of FIG. 1). Thus, while not shown in FIG. 2, the control systemshown in FIG. 2 may be implemented in conjunction with other types ofground-based stations (e.g., access points, gateways, etc.).

In a centralized control arrangement, such as that shown in FIG. 2, thecentral control system 200 (and possibly regional control systems 202Ato 202C as well) may coordinate certain mesh-networking functions forballoon network 204. For example, balloons 206A to 206I may send thecentral control system 200 certain state information, which the centralcontrol system 200 may utilize to determine the state of balloon network204. The state information from a given balloon may include locationdata, optical-link information (e.g., the identity of other balloonswith which the balloon has established an optical link, the bandwidth ofthe link, wavelength usage and/or availability on a link, etc.), winddata collected by the balloon, and/or other types of information.Accordingly, the central control system 200 may aggregate stateinformation from some or all the balloons 206A to 206I in order todetermine an overall state of the network.

The overall state of the network may then be used to coordinate and/orfacilitate certain mesh-networking functions such as determininglightpaths for connections. For example, the central control system 200may determine a current topology based on the aggregate stateinformation from some or all the balloons 206A to 206I. The topology mayprovide a picture of the current optical links that are available inballoon network and/or the wavelength availability on the links. Thistopology may then be sent to some or all of the balloons so that arouting technique may be employed to select appropriate lightpaths (andpossibly backup lightpaths) for communications through the balloonnetwork 204.

In a further aspect, the central control system 200 (and possiblyregional control systems 202A to 202C as well) may also coordinatecertain station-keeping functions for balloon network 204. For example,the central control system 200 may input state information that isreceived from balloons 206A to 206I to an energy function, which mayeffectively compare the current topology of the network to a desiredtopology, and provide a vector indicating a direction of movement (ifany) for each balloon, such that the balloons can move towards thedesired topology. Further, the central control system 200 may usealtitudinal wind data to determine respective altitude adjustments thatmay be initiated to achieve the movement towards the desired topology.The central control system 200 may provide and/or support otherstation-keeping functions as well.

As noted, FIG. 2 shows a distributed-control arrangement, with regionalcontrol systems 202A to 202C coordinating communications between acentral control system 200 and a balloon network 204. Such anarrangement may be useful in a balloon network that covers a largegeographic area. In some embodiments, a distributed control system mayeven support a global balloon network that provides coverage everywhereon earth. Of course, a distributed-control arrangement may be useful inother scenarios as well.

Further, it should be understood that other control-system arrangementsare possible. For instance, some implementations may involve adistributed control system with additional layers (e.g., sub-regionsystems within the regional control systems, and so on). Alternatively,control functions may be provided by a single, centralized, controlsystem, which communicates directly with one or more downlink balloons.

In a further aspect, control and coordination of a balloon network maybe shared between a ground-based control system and a balloon network tovarying degrees, depending upon the implementation. In fact, in someembodiments, there may be no ground-based control system. In such anembodiment, all network control and coordination functions may beimplemented by the balloon network itself. For example, certain balloonsmay be configured to provide the same or similar functions as centralcontrol system 200 and/or regional control systems 202A to 202C. Otherexamples are also possible.

Furthermore, control and/or coordination of a balloon network may bede-centralized. For example, each balloon may relay state informationto, and receive state information from, some or all nearby balloons.Further, each balloon may relay state information that it receives froma nearby balloon to some or all nearby balloons. When all balloons doso, each balloon may be able to individually determine the state of thenetwork. Alternatively, certain balloons may be designated to aggregatestate information for a given portion of the network. These balloons maythen coordinate with one another to determine the overall state of thenetwork.

Further, in some aspects, control of a balloon network may be partiallyor entirely localized, such that it is not dependent on the overallstate of the network. For example, individual balloons may implementstation-keeping functions that only consider nearby balloons. Inparticular, each balloon may implement an energy function that takesinto account its own state and the states of nearby balloons. The energyfunction may be used to maintain and/or move to a desired position withrespect to the nearby balloons, without necessarily considering thedesired topology of the network as a whole. However, when each balloonimplements such an energy function for station-keeping, the balloonnetwork as a whole may maintain and/or move towards the desiredtopology.

As an example, each balloon A may receive distance information d₁ tod_(k) with respect to each of its k closest neighbors. Each balloon Amay treat the distance to each of the k balloons as a virtual springwith vector representing a force direction from the first nearestneighbor balloon i toward balloon A and with force magnitudeproportional to d_(i). The balloon A may sum each of the k vectors andthe summed vector is the vector of desired movement for balloon A.Balloon A may attempt to achieve the desired movement by controlling itsaltitude.

Alternatively, this process could assign the force magnitude of each ofthese virtual forces equal to d_(i)×d_(i), for instance. Otheralgorithms for assigning force magnitudes for respective balloons in amesh network are possible.

In another embodiment, a similar process could be carried out for eachof the k balloons and each balloon could transmit its planned movementvector to its local neighbors. Further rounds of refinement to eachballoon's planned movement vector can be made based on the correspondingplanned movement vectors of its neighbors. It will be evident to thoseskilled in the art that other algorithms could be implemented in aballoon network in an effort to maintain a set of balloon spacingsand/or a specific network capacity level over a given geographiclocation.

D. Legally-Defined Geographic Areas within a Balloon Network

In a further aspect, which is illustrated by FIG. 2, a balloon networkmay serve a coverage area that is subdivided into a number oflegally-defined geographic areas 220 to 240. Further, while FIG. 2illustrates three legally-defined geographic areas 220 to 240, more orless legally-defined geographic areas may be defined, without departingfrom the scope of the invention. Yet further, while legally-definedgeographic areas 220 to 240 are shown as distinct coverage areas that donot overlap, it is possible that two or more legally-defined geographicareas may be defined so as to overlap (at least partially).

In one embodiment, the legally-defined geographic areas 220 to 240represent countries. In other embodiments, some or all of thelegally-defined geographic areas 220 to 240 could represent regionsother than country boundaries (e.g., a city, state, or an area whereinternational law applies). The legally-defined geographic areas 220 to240 could also represent geographic areas that are defined on atemporary basis (e.g., “disaster area” as defined periodically by theU.S. government).

In a further aspect, the legally-defined geographic areas may be definedso as to create a substantially contiguous coverage area. For instance,in the illustrated balloon network 204, legally-defined geographic areas220 to 240 and border areas 222 to 232 subdivide a substantiallycontiguous coverage area. For example, a legally-defined geographic areamay be defined for each country to divide a contiguous coverage areathat covers a continent with multiple countries, and possibly over anocean as well. Further, it is possible that worldwide coverage could besubstantially contiguous (possibly with some holes, such as over theNorth and/or South poles), and divided into legally-defined geographicareas over countries, international waters, and waters controlled bycertain countries. However, it should be understood that the coverage ofa balloon network may also extend to locations that are not part of anylegally-defined geographic area or border area, without departing fromthe scope of the invention.

In an exemplary embodiment, each balloon 206A to 206I may be providedwith an area profile of the respective legally-defined geographic area220 to 240 in which the balloon is located at a given point in time. Thearea profile of a legally-defined geographic area may includeinformation that indicates how to comply with the laws of thatlegally-defined geographic area. For example, in the illustrated stateof balloon network 204, balloons 206A to 206C may store or otherwisehave access to the area profile for legally-defined geographic area 220,balloons 206D to 206F may store or otherwise have access to the areaprofile for legally-defined geographic area 230, and balloons 206G to206I may store or otherwise have access to the area profile forlegally-defined geographic area 240.

i. Area Profile Indicating Geographically-Prohibited Data

In an exemplary embodiment, the area profile for a given legally-definedgeographic area 220 to 240 takes the form of a list of certain data orcertain types of data that are prohibited from being cached in therespective legally-defined geographic area (collectively referred to as“geographically-prohibited data”). Note that while the area profile mayidentify geographically-prohibited data, the area profile need notactually include the geographically-prohibited data. In fact, if thearea profile included the data, this might be in violation of the lawsthat prohibit the geographically-prohibited data from being stored inthe legally-defined geographic area. Thus, the fact that a balloon 206Ato 206I has received and stored an area profile does not necessarilymean that it has stored the geographically-prohibited data that isidentified by the area profile.

In some embodiments, the area profile for a given legally-definedgeographic area could also indicate geographically-prohibited data forone or more adjacent legally-defined geographic areas. For example, aballoon 206D may include an area profile associated with alegally-defined geographic area 230. The area profile may indicate alist of geographically-prohibited data corresponding to legally-definedgeographic area 230. The area profile may also indicate lists ofgeographically-prohibited data corresponding to legally-definedgeographic area 220 and legally-defined geographic area 240.

Having an area profile that indicates geographically-prohibited data inadjacent legally-defined geographic areas may be useful if a balloondoes not want to route data into a legally-defined geographic area wheresuch data is prohibited. In one embodiment, a balloon may always routedata around a legally-defined geographic area where such data isprohibited. In such an embodiment, a balloon might not need to have thearea profile for the legally-defined geographic area it is in, as havingthe area profiles for neighboring legally-defined geographic areas maysuffice. In another embodiment, a balloon may use a routing techniquewhere routing data through the legally-defined geographic area where thedata is prohibited is disfavored, but not totally out of the question.For example, the routing technique may apply a weighting factor thatfavors a route around the legally-defined geographic area where the datais prohibited, but that determination may be outweighed by other factorsthat favor routing the data through the legally-defined geographic areawhere the data is prohibited. In yet another embodiment, a balloon maynot consider geographically-prohibited data in neighboringlegally-defined geographic areas, and simply allows the balloons in therespective legally-defined geographic areas deal with identifyinggeographically-prohibited data and restricting its storage. Otherembodiments are possible as well.

ii. Area Profile Indicating Geographically-Restricted Data

In some embodiments, an area profile may identifygeographically-restricted data for a legally-defined geographic area, inaddition to geographically-prohibited data. In an exemplary embodiment,the area profile for a given legally-defined geographic area 220 to 240may identify certain geographically-restricted data or types ofgeographically-restricted data (collectively referred to as“geographically-restricted data”) that should not leave the respectivelegally-defined geographic area. Accordingly, when a given balloon 206Ato 206I is about to leave a given legally-defined geographic area 220 to240, the balloon may cross-check data stored in its data storage againstthe area profile for the given legally-defined geographic area, in orderto identify any geographically-restricted data in its data storage. Ifthe balloon identifies any geographically-restricted data, then it maydelete the geographically-restricted data before it leaves thelegally-defined geographic area.

In some embodiments, the area profile may further indicate certaingeographically-restricted data that must be stored at least one locationwithin the legally-defined geographic area. Accordingly, before aballoon deletes the geographically-restricted data, the balloon maycheck whether the data is mirrored at another balloon or other devicelocated in the legally-defined geographic area. If thegeographically-restricted data is not mirrored, then the balloon maysend the geographically-restricted data to another balloon in thelegally-defined geographic area, before it moves out of thelegally-defined geographic area.

In some cases, such as the example illustrated in FIG. 2, the coveragearea of the balloon network may include defined border areas, whichseparate the legally-defined geographic areas. In the illustratedembodiment, legally-defined geographic areas 220 and 230 are separatedby border area 222, while legally-defined geographic areas 230 and 240are separated by border area 232. In one embodiment, a border area mayalso be treated as an area where two or more coverage areas overlap. Forinstance, border area 222 may be created by defining legally-definedgeographic areas 220 and 230 such that these geographic areas overlap inborder area 222. In another embodiment, a border area may be treated asa distinct area that separates two adjacent coverage areas.

As noted, a balloon 206A to 206I may delete geographically-restricteddata in response to determining that it is likely to move out of alegally-defined geographic area. A balloon may determine that it islikely to move out of a legally-defined geographic area in various ways.Several non-limiting examples will now be provided.

In some embodiments, a balloon 206A to 206I may deletegeographically-restricted data for a given legally-defined geographicarea when or shortly after it moves into a border area 222 or 232 of thegiven legally-defined geographic area. In other words, moving intoand/or remaining in the border area for a certain period of time may beconsidered to be an indication that the balloon is likely to move out ofthe legally-defined geographic area, so the balloon may responsivelydelete geographically-restricted data. For example, a balloon 206C maydetect that it has moved from the location illustrated in FIG. 2, withinlegally-defined geographic area 220, to a location within border area222. In response, balloon 206C may delete any geographically-restricteddata that is identified by the area profile for legally-definedgeographic area 220.

In some embodiments, balloon 206C may determine that it is likely tomove out of a legally-defined geographic area 220 by checking itsprevious, current, and/or planned direction of movement to verify thatit is heading out of legally-defined geographic area 220. Further, basedon the previous, current, and/or planned direction of movement, balloon206C may determine the probability that it will move out of thelegally-defined geographic area 220. As such, when balloon 206C islocated in border area 222, balloon 206C may condition the deleting ofits area profile upon a determination that the probability of moving outof the legally-defined geographic area 220 is greater than a thresholdprobability.

Note that while the border areas 222 and 232 that are illustrated inFIG. 2 can be described and/or defined as areas that separate and/or atleast partially define legally-defined geographic areas 220 to 240,legally-defined geographic areas may be defined without defining borderareas. Further, border areas can alternatively be described and/ordefined as areas where two or more geographic areas overlap. As yetanother alternative, there may be no border areas whatsoever (eitherdefined specifically, as areas that separate legally-defined geographicareas, or as a result of overlapping legally-defined geographic areas).

In some embodiments, balloons may request and/or receive some or all ofan area profile from a ground-based station. For example, a controlsystem may maintain a profile database indicating the settings forcertain operational parameters to be used by balloons while operating ina given legally-defined geographic area and/or other data that isassociated with a given legally-defined geographic area. Such a profiledatabase may be searchable by legally-defined geographic area, such thatan area profile may be determined for a given legally-defined geographicarea. Accordingly, a control system may query the database to retrievesome or all of the area profile that is associated with a particularlegally-defined geographic area. Further, there may be a single,central, database that is searchable to determine particular areaprofiles, or a number of separate databases that collectively providethe area profiles for all legally-defined geographic areas in a balloonnetwork.

In some embodiments, the control system may be a central control system200, which provides the area profiles for all legally-defined geographicareas in a balloon network. In other embodiments, there may be a numberof regional control systems 202A to 202C, which may operateindependently or may communicate with a central control system thatcoordinates and/or controls certain functions of the regional systems,such as is illustrated in FIG. 2.

More specifically, in the configuration illustrated in FIG. 2, regionalcontrol systems 202A to 202C may provide at least a portion of therespective area profile for each of legally-defined geographic areas 220to 240. Accordingly, a balloon may determine its area profile accordingto the area profile for a given legally-defined geographic area 220 to240 by communicating with the regional control system 202A to 202C thatis associated with the given legally-defined geographic area.

Further, to determine its area profile according to its currentlegally-defined geographic area, a balloon may communicate directly witha regional control system 202A to 202C, or may communicate indirectlywith a regional control system via other balloons and/or otherground-based stations. For example, in the illustrated state of balloonnetwork 204, balloon 206A may send an area profile request directly toregional control system 202A. In another example, balloon 206C may sendan area profile request to regional control system 202A indirectly;e.g., via balloon 206A or via balloon 206B and 206A. Other examples arepossible as well.

In some embodiments, balloon 206A may not actually store some or all ofthe area profile. Instead, a ground-based station and/or designatedballoon in the balloon network 204 may store the area profile, and otherballoons in the balloon network may simply query the ground-basedstation and/or the designated balloon for the information from the areaprofile.

In one embodiment, a given balloon 206A to 206I may periodically sendlocation update messages to one or more ground-based control systems,which indicate the balloon's location. As such, when a control systemdetermines that a balloon has moved to a location associated with a newlegally-defined geographic area, the control system may responsivelysend an area profile signal to the balloon, which indicates and/orprovides some or all of the area profile for the new legally-definedgeographic area. Further, the control system may initiate a transmissionto the balloon of the geographically-prohibited data corresponding tothe legally-defined geographic area.

E. Exemplary Balloon Configuration

Various types of balloon systems may be incorporated in an exemplaryballoon network. As noted above, an exemplary embodiment may utilizehigh-altitude balloons, which typically operate in an altitude rangebetween 17 km and 22 km. FIG. 3 is a simplified block diagramillustrating a high-altitude balloon 300, according to an exemplaryembodiment. As shown, the balloon 300 includes an envelope 302, a skirt304, a payload 306, and a cut-down system 308 that is attached betweenthe balloon 302 and payload 304.

The envelope 302 and skirt 304 may take various forms, which may becurrently well-known or yet to be developed. For instance, the envelope302 and/or skirt 304 may be made of a highly-flexible latex material ormay be made of a rubber material such as chloroprene. Other materialsare also possible. Further, the shape and size of the envelope 302 andskirt 304 may vary depending upon the particular implementation.Additionally, the envelope 302 may be filled with various differenttypes of gases, such as helium and/or hydrogen. Other types of gases arepossible as well.

The payload 306 of balloon 300 may include a processor 312 and on-boarddata storage, such as memory 314. The memory 314 may take the form of orinclude a non-transitory computer-readable medium. The non-transitorycomputer-readable medium may have instructions stored thereon, which canbe accessed and executed by the processor 312 in order to carry out theballoon functions described herein.

The payload 306 of balloon 300 may also include various other types ofequipment and systems to provide a number of different functions. Forexample, payload 306 may include optical communication system 316, whichmay transmit optical signals via an ultra-bright LED system 320, andwhich may receive optical signals via an optical-communication receiver(e.g., a photo-diode receiver system). Further, payload 306 may includean RF communication system 318, which may transmit and/or receive RFcommunications via an antenna system 340. The payload 306 may alsoinclude a power supply 326 to supply power to the various components ofballoon 300. The payload 306 may also include a solar power generationsystem 327.

Further, payload 306 may include various types of other systems andsensors 328. For example, payload 306 may include one or more videoand/or still cameras, a GPS system, various motion sensors (e.g.,accelerometers, gyroscopes, and/or compasses), and/or various sensorsfor capturing environmental data. Further, some or all of the componentswithin payload 306 may be implemented in a radiosonde, which may beoperable to measure, e.g., pressure, altitude, geographical position(latitude and longitude), temperature, relative humidity, and/or windspeed and/or direction, among other information.

As noted, balloon 306 includes an ultra-bright LED system 320 forfree-space optical communication with other balloons. As such, opticalcommunication system 316 may be configured to transmit a free-spaceoptical signal by modulating the ultra-bright LED system 320. Theoptical communication system 316 may be implemented with mechanicalsystems and/or with hardware, firmware, and/or software. Generally, themanner in which an optical communication system is implemented may vary,depending upon the particular application.

In a further aspect, balloon 300 may be configured for altitude control.For instance, balloon 300 may include a variable buoyancy system, whichis configured to change the altitude of the balloon 300 by adjusting thevolume and/or density of the gas in the balloon 300. A variable buoyancysystem may take various forms, and may generally be any system that canchange the volume and/or density of gas in envelope 302.

In an exemplary embodiment, a variable buoyancy system may include abladder 310 that is located inside of envelope 302. The buoyancy of theballoon 300 may therefore be adjusted by changing the density and/orvolume of the gas in bladder 310. To change the density in bladder 310,balloon 300 may be configured with systems and/or mechanisms for heatingand/or cooling the gas in bladder 310. Further, to change the volume,balloon 300 may include pumps or other features for adding gas to and/orremoving gas from bladder 310. Additionally or alternatively, to changethe volume of bladder 310, balloon 300 may include release valves orother features that are controllable to allow air to escape from bladder310.

Further, a balloon 306 may include a navigation system (not shown). Thenavigation system may implement station-keeping functions to maintainposition within and/or move to a position in accordance with a desiredtopology. In particular, the navigation system may use altitudinal winddata to determine altitudinal adjustments that result in the windcarrying the balloon in a desired direction and/or to a desiredlocation. The altitude-control system make then make adjustments to thedensity of the balloon chamber in order to effectuate the determinedaltitudinal adjustments and cause the balloon to move laterally to thedesired direction and/or to the desired location. Alternatively, thealtitudinal adjustments may be computed by a ground-based control systemand communicated to the high-altitude balloon.

As shown, the balloon 300 also includes a cut-down system 308. Thecut-down system 308 may be activated to separate the payload 306 fromthe rest of balloon 300. This functionality may be utilized anytime thepayload needs to be accessed on the ground, such as when it is time toremove balloon 300 from a balloon network, when maintenance is due onsystems within payload 306, and/or when power supply 326 needs to berecharged or replaced.

In an alternative arrangement, a balloon may not include a cut-downsystem. In such an arrangement, the navigation system may be operable tonavigate the balloon to a landing location, in the event the balloonneeds to be removed from the network and/or accessed on the ground.Further, it is possible that a balloon may be self-sustaining, such thatit theoretically does not need to be accessed on the ground.

III. Balloon Network with Optical and RF Links Between Balloons

In some embodiments, a high-altitude-balloon network may includesuper-node balloons, which communicate with one another via opticallinks, as well as sub-node balloons, which communicate with super-nodeballoons via RF links. FIG. 4 is a simplified block diagram illustratinga balloon network that includes super-nodes and sub-nodes, according toan exemplary embodiment. More specifically, FIG. 4 illustrates a portionof a balloon network 400 that includes super-node balloons 410A to 410C(which may also be referred to as “super-nodes”) and sub-node balloons420A to 420Q (which may also be referred to as “sub-nodes”).

Each super-node balloon 410A to 410C may include a free-space opticalcommunication system that is operable for packet-data communication withother super-node balloons. As such, super-nodes may communicate with oneanother over optical links. For example, in the illustrated embodiment,super-node 410A and super-node 401B may communicate with one anotherover optical link 402, and super-node 410A and super-node 401C maycommunicate with one another over optical link 404.

Each of the sub-node balloons 420A to 420Q may include a radio-frequency(RF) communication system that is operable for packet-data communicationover one or more RF air interfaces. Accordingly, some or all of thesuper-node balloons 410A to 410C may include an RF communication systemthat is operable to route packet data to one or more nearby sub-nodeballoons 420A to 420Q. When a sub-node 420A receives data from asuper-node 410A via an RF link, the sub-node 420A may in turn use its RFcommunication system to transmit the received data to a ground-basedstation 430A to 430L via an RF link.

In some embodiments, all sub-node balloons may be configured toestablish RF links with ground-based stations. For example, allsub-nodes may be configured similarly to sub-node 420A, which isoperable to relay communications between super-node 410A and aground-based station 430A via respective RF links.

In other embodiments, some or all sub-nodes may also be configured toestablish RF links with other sub-nodes. For instance, in theillustrated embodiment, sub-node balloon 420F is operable to relaycommunications between super-node 410C and sub-node balloon 420E. Insuch an embodiment, two or more sub-nodes may provide a multi-hop pathbetween a super-node balloon and a ground-based station, such as themulti-hop path provided between super-node 410C and a ground-basedstation 430E by sub-node balloons 420E and 420F.

Note that an RF link may be a directional link between a given entityand one or more other entities, or may be part of an omni-directionalbroadcast. In the case of an RF broadcast, it is possible that one ormore “links” may be provided via a single broadcast. For example,super-node balloon 410A may establish a separate RF link with each ofsub-node balloons 420A, 420B, and 420C. However, in otherimplementations, super-node balloon 410A may broadcast a single RFsignal that can be received by sub-node balloons 420A, 420B, and 420C.In such an implementation, the single RF broadcast may effectivelyprovide all of the RF links between super-node balloon 410A and sub-nodeballoons 420A, 420B, and 420C. Other examples are also possible.

Generally, the free-space optical links between super-node balloons havemore bandwidth capacity than the RF links between super-node balloonsand sub-node balloons. Further, free-space optical communication may bereceived at a much greater distance than RF communications. As such, thesuper-node balloons 410A to 410C may function as the backbone of theballoon network 400, while the sub-nodes 420A to 420Q may providesub-networks providing access to the balloon network and/or connectingthe balloon network to other networks.

As noted above, the super-nodes 410A to 410C may be configured for bothlonger-range optical communication with other super-nodes andshorter-range RF communications with nearby sub-nodes 420. For example,super-nodes 410A to 410C may use high-power or ultra-bright LEDs totransmit optical signals over optical links 402, 404, which may extendfor as much as 100 miles, or possibly more. Configured as such, thesuper-nodes 410A to 410C may be capable of optical communications atdata rates of 10 to 50 Gbit/sec.

A larger number of high-altitude balloons may then be configured assub-nodes, which may communicate with ground-based Internet nodes atdata rates on the order of approximately 10 Mbit/sec. For instance, inthe illustrated implementation, the sub-nodes 420A to 420Q may beconfigured to connect the super-nodes 410A to 410C to other networksand/or directly to client devices. Note that the data rates and linkdistances described in the above example and elsewhere herein areprovided for illustrative purposes and should not be consideredlimiting; other data rates and link distances are possible.

In a further aspect, some or all of the super-node balloons may beconfigured as downlink balloons. Additionally or alternatively, some orall of sub-nodes 420A to 420Q may be configured as downlink balloons.Further, it is possible that a hierarchical balloon network such as thatshown in FIG. 4 may be implemented without any downlink balloons.

Further, in some embodiments, the super-node balloons, such assuper-nodes 410A to 410C, may function as a core network (i.e., abackbone network), while the sub-node balloons 420A to 420Q may functionas one or more access networks to the core network of super-nodes. Insuch an embodiment, some or all of the sub-nodes 420A to 420Q may alsofunction as gateways to the balloon network 400. Note also that in someembodiments, some or all of the ground-based stations 430A to 430L mayadditionally or alternatively function as gateways to balloon network400.

In another aspect, it should be understood that the network topology ofthe hierarchical balloon network shown in FIG. 4 is but one of manypossible network topologies. Further, the network topology of anexemplary balloon network may vary dynamically as super-node and/orsub-node balloons move relative to the ground and/or relative to oneanother. Further, as with the balloon networks illustrated in FIGS. 1and 2, a desired topology may be specified for a hierarchical balloonnetwork may change dynamically over time as service needs and/or goalsof the network change.

Legally-defined geographic areas can be defined in a heterogeneousballoon network, such as balloon network 400. For example, as shown inFIG. 4, legally-defined geographic areas 470, 480, and 490 may bedefined within the coverage area of balloon network 400.

In an embodiment where super-node balloons 410A to 410C serve as a corenetwork, and sub-node balloons 420A to 420Q provide an access network oraccess networks, location-specific area profiles may only be implementedby the sub-node balloons 420A to 420Q. Alternatively, both super-nodeballoons 410A to 410C and sub-node balloons 420A to 420Q can implementlocation-specific area profiles.

Further, in some embodiments, a super-node balloon 410A to 410C mayfacilitate implementation of location-specific area profiles by some orall of sub-node balloons 420A to 420Q. For example, each super-nodeballoon 410A to 410C could store a area profile for a certainlegally-defined geographic area 470 to 490, respectively. As such, asub-node balloon 420A to 420Q could query a nearby super-node balloonfor the area profile that is associated with the legally-definedgeographic area in which it located or anticipates that it will soon belocated. Alternatively, a super-node balloon 410A to 410C may functionas a control system, in a similar manner as described above in referenceto FIG. 2. Other implementations of location-specific area profiles inheterogeneous balloon networks are also possible.

IV. Examples of Methods

FIGS. 5 and 6 are simplified flow charts illustrating methods 500 and600, respectively. Although the blocks in FIGS. 5 and 6 are illustratedin a sequential order, these blocks may also be performed in parallel,and/or in a different order than those described herein. Also, thevarious blocks may be combined into fewer blocks, divided intoadditional blocks, and/or removed based upon the desired implementation.

Further, while method 500 and method 600 are described by way of exampleas being carried out by a balloon (e.g., by a computing system of aballoon), it should be understood that an exemplary method or a portionthereof may be carried out by another entity or combination of entities,without departing from the scope of the invention.

In addition, for method 500 and method 600, the flowchart showsfunctionality and operation of one possible implementation of presentembodiments. In this regard, each block may represent a module, asegment, or a portion of program code, which includes one or moreinstructions executable by a processor for implementing specific logicalfunctions or steps in the process. The program code may be stored on anytype of computer-readable medium, for example, such as a storage deviceincluding a disk or hard drive. The computer-readable medium may includenon-transitory computer-readable medium, for example, such ascomputer-readable media that stores data for short periods of time likeregister memory, processor cache and Random Access Memory (RAM). Thecomputer-readable medium may also include non-transitory media, such assecondary or persistent long term storage, like read only memory (ROM),optical or magnetic disks, compact-disc read only memory (CD-ROM), forexample. The computer-readable media may also be any other volatile ornon-volatile storage systems. The computer-readable medium may beconsidered a computer-readable storage medium, for example, or atangible storage device.

A. Example Handling Data that is Geographically Prohibited in theLegally-Defined Geographic Area Where a Balloon is Located

FIG. 5 is a simplified flow chart illustrating method 500, according toan exemplary embodiment. At block 502, method 500 involves determiningthat a first balloon is at a location associated with a legally-definedgeographic area. In one example, referring to FIG. 3, the positioningsystem 324 of the first balloon may determine a current location of thefirst balloon to be within (e.g., located over) the legally-definedgeographic area. Other embodiments are possible as well.

In one embodiment, balloons in the balloon network are provided withsoftware for situations when a balloon could no longer determine itslocation. Such software may be a function of the last known location ofthe balloon, whether the new location of the balloon is totally unknownor harder to verify, how long the balloon has been in a geographicallyindeterminate state, what data the balloon is carrying, and what rulesapplied to that data where the balloon had been. For example, such asoftware system might be set so that from a last known location andtraveling at a known speed and direction, the system will calculate whenthe balloon would be expected to leave the legally-defined geographicarea and would execute its other procedures as described herein asthough it were leaving this area at two minutes prior to the estimatedarea-exit time. The software may contain other functions as well.

At block 504, method 500 further involves determining that the firstlegally-defined geographic area has an area profile that identifies alist of geographically-prohibited data that is restricted from beingcached in the first legally-defined geographic area. Eachlegally-defined geographic area may have its own rules regarding whatdata or types of data cannot be cached in that area. For example, anarea profile may identify certain data, or certain types of data, whichcannot be cached in certain legally-defined geographic areas. In oneexample, an area profile may identify a prohibited class of data thatmust not be cached in certain legally-defined geographic areas. Oneexample of such a class of data is pornography, which cannot be cachedin certain legally-defined geographic areas. In another example, an areaprofile may identify a prohibited instance of data that must not becached in certain legally-defined geographic areas. For example, inChina, which has a law prohibiting data content originating from acertain prohibited server. Other examples of prohibited data orprohibited types of data are possible as well.

An area profile for a legally-defined geographic area may specifyoperating parameters such that balloons that are located in thelegally-defined geographic area will operate in accordance with thelegal requirements established by the governing body of that area.Accordingly, balloons must adapt their operation to varying legalrequirements of differently-governed legally-defined geographic areasas, e.g., they move from one country, state, city to another (and/orinto an area where international law applies). In an example embodiment,the area profile for a first legally-defined geographic area may includea list of geographically-prohibited data that is restricted from beingcached in the first legally-defined geographic area.

A balloon may use various techniques to determine the area profile forthe legally-defined geographic area. In some embodiments, the balloonmay request and/or receive some or all of an area profile from aground-based station that is associated with the legally-definedgeographic area for which the area profile is being requested. As such,a balloon may acquire some or all of the information making up an areaprofile from the ground-based station or stations that are located in orotherwise associated with the legally-defined geographic area.

For example, a control system may maintain a profile database providinginformation indicating the rules in a given legally-defined geographicarea and/or other data that is associated with a given legally-definedgeographic area. In some embodiments, the control system may be acentral control system, which provides the area profiles for alllegally-defined geographic areas in a balloon network. In otherembodiments, there may be a number of regional control systems, whichmay operate independently or may communicate with a central controlsystem that coordinates and/or controls certain functions of theregional systems.

More specifically, in the configuration with regional control systems,the regional control systems may provide at least a portion of therespective area profile for each of the legally-defined geographicareas. Accordingly, a balloon may determine its area profile accordingto the area profile for a given legally-defined geographic area bycommunicating with the regional control system that is associated withthe given legally-defined geographic area. Further, to determine itsarea profile according to its current legally-defined geographic area, aballoon may communicate directly with a regional control system, or maycommunicate indirectly with a regional control system via other balloonsand/or other ground-based stations. For example, a balloon may send anarea profile request directly to a regional control system. In anotherexample, a balloon may send an area profile request to a regionalcontrol system indirectly; e.g., via another balloon located in the samelegally-defined geographic area.

In at least some embodiments, balloon 206A does not actually store thearea profile. Instead, a ground-based station and/or designated balloonin the balloon network 204 may store the area profile, and otherballoons in the balloon network may simply query the ground-basedstation and/or the designated balloon for the information from the areaprofile.

In some embodiments, some or all balloons that operate in a balloonnetwork may be configured to broadcast an area profile signal via adesignated communication channel, which indicates at least a portion ofthe area profile for a geographic area with which the broadcastingballoon is associated (e.g., the legally-defined geographic area inwhich the balloon is currently located or a legally-defined geographicarea that the balloon was recently located in). In such an embodiment,block 504 may involve the balloon that seeks to determine the areaprofile for the first legally-defined geographic area, searching thedesignated communication channel for an area profile signal thatindicates at least a portion of the area profile for the firstlegally-defined geographic area.

In a further aspect, an exemplary method may involve the balloondetecting it is in a legally-defined geographic area (e.g., determiningits GPS coordinates are within boundary of a legally-defined geographicarea), determining that it does not have the area profile for thatlegally-defined geographic area (which takes the form of or includes thelist of geographically-restricted data), and requesting the profile fromanother balloon or ground-based station.

At block 506, method 500 further involves receiving first data. In oneembodiment, the first data is sent from a device located in the firstlegally-defined geographic area. In another embodiment, the first datais sent from a device located outside of the first legally-definedgeographic area. The device sending the first data may be a personalcomputer, a handheld wireless communication device, or any other deviceconnected to the balloon network. Other embodiments are possible aswell.

At block 508, method 500 further involves using the list ofgeographically-prohibited data to determine whether or not the firstdata is geographically-prohibited data. In one embodiment, the receivedfirst data is compared to the list of geographically-prohibited data bylooking at metadata in the first data to determine a class or type ofdata, the source of the data, the target destination of the data, and/orother information. This information may then be compared with the listof geographically-prohibited data to determine if the first data isgeographically-prohibited data. Other embodiments are possible as well.

If it is determined that the first data is geographically-prohibiteddata, the method 500 continues at block 510 with refraining from storingthe first data in data storage at the first balloon. In one embodiment,a balloon may implement a routing process in which data can be cached inthe data storage at the first balloon. In such an embodiment, when theballoon determines that the first data is geographically-prohibited, theballoon may alter the routing process such that the first data is notcached in the data storage at the first balloon as part of the routingprocess.

In one embodiment, geographically-prohibited data may be routed througha balloon without violating a law that it can't be cached. For example,when a data file is being routed through a balloon, the file may bepacketized such that the balloon never stores a complete copy of thefile (i.e., it only includes the packets that are in its outboundrouting queue). If a data file is cached, however, the balloon may storepackets as they are routed so that a complete copy of the data file iskept for later use (e.g., so it is quickly available from the balloon ata later time).

In another embodiment, the first data may be encrypted when a ballooncarrying the first data is located in a legally-defined geographic areawhere such data is prohibited from being stored (e.g., cached). In suchan embodiment, the legally-defined geographic area or a neutral thirdparty may possess the key to decrypt the geographically-prohibited dataso that the balloon owner and/or operator could not decode that piece ofdata. When the balloon leaves the legally-defined geographic area, thedata could be decrypted, and the cache restored. Other embodiments arepossible as well.

If it is determined that the first data is not geographically-prohibiteddata, the method 500 progresses from block 508 to block 512 withdetermining that the first data is storeable in the data storage at thefirst balloon.

B. Method for Handling Data that is Geographically Prohibited inNeighboring Legally-Defined Geographic Area(s)

FIG. 6 is a simplified flow chart illustrating method 600, according toan exemplary embodiment. At block 602, method 600 involves determiningthat a first balloon is at a location associated with a legally-definedgeographic area, as discussed above.

At block 604, method 600 further involves determining that the firstballoon has an area profile that indicates, for each of one or moresecond legally-defined geographic areas, a list ofgeographically-prohibited data that is restricted from being cached inthe respective second legally-defined geographic area. For example, thearea profile may indicate a first list identifyinggeographically-prohibited data that is restricted from being cached in asecond legally-defined geographic area. Additionally, the area profilemay indicate a second list identifying geographically-prohibited datathat is restricted from being cached in a third legally-definedgeographic area. A balloon may use various techniques to determine thearea profile, as discussed above. In one embodiment, the second andthird legally-defined geographic areas may be adjacent to the firstlegally-defined geographic area.

In one embodiment, the list of geographically-prohibited data mayidentify a prohibited class of data that must not be cached in certainlegally-defined geographic areas. In another embodiment, the list ofgeographically-prohibited data may identify a prohibited instance ofdata that must not be cached in certain legally-defined geographicareas. Other examples of prohibited data or prohibited types of data arepossible as well.

At block 606, the method 600 further involves receiving first data, asdiscussed above. At block 608, method 600 further involves using thelists of geographically-prohibited data to determine whether or not thefirst data is geographically-prohibited data in the at least one of thesecond legally-defined geographic areas. In one embodiment, the receivedfirst data is compared to the lists of geographically-prohibited data bylooking at metadata in the first data to determine a class or type ofdata, the source of the data, the target destination of the data, and/orother information. This information may then be compared with the listsof geographically-prohibited data to determine if the first data isgeographically-prohibited data. Other embodiments are possible as well.

If it is determined that the first data is geographically-prohibiteddata in the at least one of the second legally-defined geographic areas,the method 600 continues at block 610 with routing the first datatowards a first destination. If it is determined that the first data isnot geographically-prohibited data in the at least one of the secondlegally-defined geographic areas, the method 600 continues at block 612with routing the first data towards a second destination. The first datais routed towards a particular destination based on the determination asto whether or not the first data is geographically-prohibited data.

As a specific example, a balloon is located above Country A. The balloonhas an area profile indicating a first list of geographically-prohibiteddata that is restricted from being cached in Country B. The area profilealso indicates a second list of geographically-prohibited data that isrestricted from being cached in Country C. When the balloon receivesdata, the balloon uses the first and second lists to determine when thereceived data is geographically-prohibited data in either Country B orCountry C. The received data is then routed towards a destination basedon the determination as to whether or not the received data isgeographically-prohibited. For example, if the received data isgeographically-prohibited data in Country B, the received data may berouted through Country C so as to comply with the laws of Country B.Other embodiments are possible as well.

C. Computer-Readable Medium Configured to Handle Data that isGeographically-Prohibited

FIG. 7 depicts a computer-readable medium configured according to anexample embodiment. In example embodiments, the example system caninclude one or more processors, one or more forms of memory, one or moreinput devices/interfaces, one or more output devices/interfaces, andmachine-readable instructions that when executed by the one or moreprocessors cause the system to carry out the various functions, tasks,capabilities, etc., described above.

As noted above, in some embodiments, the disclosed methods can beimplemented by computer program instructions encoded on a non-transitorycomputer-readable storage media in a machine-readable format, or onother non-transitory media or articles of manufacture. FIG. 7 is aschematic illustrating a conceptual partial view of an example computerprogram product that includes a computer program for executing acomputer process on a computing device, arranged according to at leastsome embodiments presented herein.

In one embodiment, the example computer program product 700 is providedusing a signal bearing medium 702. The signal bearing medium 702 mayinclude one or more programming instructions 704 that, when executed byone or more processors may provide functionality or portions of thefunctionality described above with respect to FIGS. 1-6. In someexamples, the signal bearing medium 702 can be a computer-readablemedium 706, such as, but not limited to, a hard disk drive, a CompactDisc (CD), a Digital Video Disk (DVD), a digital tape, memory, etc. Insome implementations, the signal bearing medium 702 can be a computerrecordable medium 708, such as, but not limited to, memory, read/write(R/W) CDs, R/W DVDs, etc. In some implementations, the signal bearingmedium 702 can be a communications medium 710, such as, but not limitedto, a digital and/or an analog communication medium (e.g., a fiber opticcable, a waveguide, a wired communications link, a wirelesscommunication link, etc.). Thus, for example, the signal bearing medium702 can be conveyed by a wireless form of the communications medium 710.

The one or more programming instructions 704 can be, for example,computer executable and/or logic implemented instructions. In someexamples, a computing device such as the processor 312 of FIG. 3 isconfigured to provide various operations, functions, or actions inresponse to the programming instructions 704 conveyed to the processor312 by one or more of the computer-readable medium 706, the computerrecordable medium 708, and/or the communications medium 710.

The non-transitory computer-readable medium could also be distributedamong multiple data storage elements, which could be remotely locatedfrom each other. The computing device that executes some or all of thestored instructions could be a balloon, such as the balloon illustratedin FIG. 3. Alternatively, the computing device that executes some or allof the stored instructions could be another computing device, such as aserver.

V. Implementing Functionality for Both Geographically Prohibited andGeographically Restricted Data

In addition to the methods described above, a balloon may implementfunctionality for geographically-restricted data. Each legally-definedgeographic area may have its own rules regarding what data cannot beremoved from that area and/or must be stored in that area. For example,an area profile may identify certain user-data, or certain types ofuser-data, which cannot leave a certain legally-defined geographic area.Such an area profile may be defined in accordance with privacy lawsenacted in those legally-defined geographic areas, or defined for otherreasons. The area profile discussed above in relation to method 500 andmethod 600 may further indicate such geographically-restricted data.

In one embodiment, the control system of a first balloon may scan thememory of the first balloon to determine if the first balloon containsat least some of the geographically-restricted data. The control systemof the first balloon may also be configured to detect when the firstballoon is likely to move out of a first legally-defined geographicarea. In one embodiment, the first balloon may determine that it islikely to move out of the legally-defined geographic area by checkingits previous, current, and/or planned direction of movement to verifythat it is heading out of the legally-defined geographic area. Further,based on the previous, current, and/or planned direction of movement,the first balloon may determine the probability that it will move out ofthe legally-defined geographic area. As such, when the first balloon islocated in a border area, the first balloon may condition the removal ofthe geographically-restricted data upon a determination that theprobability of moving out of the legally-defined geographic area isgreater than a threshold probability. Other embodiments are possible aswell.

Once it is determined that the first balloon is likely to move out ofthe first legally-defined geographic area, the control system may befurther configured to responsively remove the geographically-restricteddata from the memory of the first balloon.

In one embodiment, the geographically-restricted data does not need tobe saved, and can simply be removed from the memory of the first balloonbefore the first balloon leaves the legally-defined geographic area. Inanother embodiment, the area profile further requires that thegeographically-restricted data be saved in at least one location in thelegally-defined geographic area. In an example embodiment, the areaprofile for the legally-defined geographic area may include a list ofgeographically-restricted data that must be saved in at least onelocation in the legally-defined geographic area.

The control system may be configured to determine if a second balloonlocated in the first legally-defined geographic area contains thegeographically-restricted data. Responsive to the determination that thesecond balloon does not include the geographically-sensitive data, thecontrol system may be further configured to transfer thegeographically-restricted data from the first balloon to a device thatis located in the first legally-defined geographic area, before removingthe geographically-restricted data from the memory of the first balloon.

In one embodiment, the device receiving the geographically-restricteddata from the first balloon is a second balloon that is operable in theballoon network and is located in the legally-defined geographic area.In another embodiment, the device receiving thegeographically-restricted data from the first balloon is a ground-basedstation located in the legally-defined geographic area. In oneembodiment, the geographically-restricted data is transferred from thefirst balloon to the device via a RF air-interface. In anotherembodiment, the geographically-restricted data is transferred from thefirst balloon to the device via a free-space optical link.

As a specific example, geographically-restricted data that must notleave Country Z comprises data A, B, C and D. A first balloon located inCountry Z includes data A and B. A second balloon located in Country Zcontains data C. A third balloon located in Country Z contains data D.If it is determined that the third balloon is likely to leave Country Z,the third balloon checks to see if another balloon or ground-basedstation located in Country Z contains data D. If the third balloondetermines that no other device in Country Z includes data D, the thirdballoon transfers data D to another balloon or a ground-based stationlocated in Country Z. Then, the third balloon removes data D from itsmemory before it leaves Country Z so as to comply with the laws ofCountry Z. Other embodiments are possible as well.

VI. Conclusion

The particular arrangements shown in the Figures should not be viewed aslimiting. It should be understood that other embodiments may includemore or less of each element shown in a given Figure. Further, some ofthe illustrated elements may be combined or omitted. Yet further, anexemplary embodiment may include elements that are not illustrated inthe Figures.

Additionally, while various aspects and embodiments have been disclosedherein, other aspects and embodiments will be apparent to those skilledin the art. The various aspects and embodiments disclosed herein are forpurposes of illustration and are not intended to be limiting, with thetrue scope and spirit being indicated by the following claims. Otherembodiments may be utilized, and other changes may be made, withoutdeparting from the spirit or scope of the subject matter presentedherein. It will be readily understood that the aspects of the presentdisclosure, as generally described herein, and illustrated in thefigures, can be arranged, substituted, combined, separated, and designedin a wide variety of different configurations, all of which arecontemplated herein.

I claim:
 1. A computer-implemented method comprising: while a firstballoon is at a location within a first legally-defined geographic area,accessing a first list of geographically-prohibited data that identifiesdata that is restricted from being cached by the first balloon while thefirst balloon is at the location within the first legally-definedgeographic area, wherein the first balloon is part of a balloon networkincluding a plurality of moveable balloons that provide service toclient devices in a plurality of legally-defined geographic areas;determining that the first balloon has moved from the firstlegally-defined geographic area to a location within a secondlegally-defined geographic area; in response to determining that thefirst balloon has moved to the location within the secondlegally-defined geographic area, the first balloon refraining fromaccessing the first list of geographically-prohibited data and insteadaccessing a second list of geographically-prohibited data thatidentifies data that is restricted from being cached by the firstballoon while the first balloon is at the location within the secondlegally-defined geographic area, wherein the second list ofgeographically-prohibited data further indicatesgeographically-prohibited data for each of one or more additionallegally-defined geographic areas; while the first balloon is at thelocation within the second legally-defined geographic area, the firstballoon receiving data; using the second list ofgeographically-prohibited data to determine that the received data isgeographically-prohibited data in the second legally-defined geographicarea; and responsive to a determination that the received data isgeographically-prohibited data in the second legally-defined geographicarea, (i) identifying a second balloon of the plurality of balloons thatis at a location outside of the second legally-defined geographic area,(ii) using the second list of geographically-prohibited data todetermine that the received data is not geographically-prohibited at thelocation of the second balloon, (iii) routing the received data to thesecond balloon, and (iv) refraining from caching the received data indata storage at the first balloon while the first balloon is at thelocation within the second legally-defined geographic area.
 2. Themethod of claim 1, wherein the second list of geographically-prohibiteddata that is restricted from being cached in the second legally-definedgeographic area comprises a prohibited class of data.
 3. The method ofclaim 1, wherein the second list of geographically-prohibited data thatis restricted from being cached in the second legally-defined geographicarea comprises a prohibited instance of data.
 4. The method of claim 1,further comprising: the first balloon receiving the first list ofgeographically-prohibited data from a first ground-based station that isassociated with the first legally-defined geographic area; and the firstballoon receiving the second list of geographically-prohibited data froma second ground-based station that is associated with the secondlegally-defined geographic area.
 5. The method of claim 1, furthercomprising the first balloon receiving the first and second lists ofgeographically-prohibited data from the second balloon.
 6. The method ofclaim 1, wherein the first balloon implements a routing process in whichdata cannot be cached in the data storage at the first balloon, andwherein refraining from caching the received data in the data storage atthe first balloon comprises the balloon altering the routing processsuch that the received data is not cached in the data storage at thefirst balloon as part of the routing process.
 7. The method of claim 1,wherein the one or more additional legally-defined geographic areas areadjacent to the second legally-defined geographic area.
 8. Acomputer-implemented method comprising: determining that a first balloonhas moved from outside of a first legally-defined geographic area to alocation within the first legally-defined geographic area, wherein thefirst balloon is part of a balloon network including a plurality ofmoveable balloons that provide service to client devices in a pluralityof legally-defined geographic areas; in response to determining that thefirst balloon has moved to the location within the first legally-definedgeographic area, the first balloon accessing: (i) a first list ofgeographically-prohibited data that identifies data that is restrictedfrom being cached in a second legally-defined geographic area, and (ii)a second list of geographically-prohibited data that identifies datathat is restricted from being cached in a third legally-definedgeographic area; while the first balloon is at the location within thefirst legally-defined geographic area, the first balloon receiving data;using the first list of geographically-prohibited data and the secondlist of geographically-prohibited data as a basis for making adetermination that the received data is geographically-prohibited datain the second legally-defined geographic area but notgeographically-prohibited data in the third legally-defined geographicarea; and based on the determination that the received data isgeographically-prohibited data in the second legally-defined geographicarea but not geographically-prohibited data in the third legally-definedgeographic area, (i) identifying a second balloon of the plurality ofballoons that is at a location within the third legally-definedgeographic area, and (ii) routing the received data towards the secondballoon.
 9. The method of claim 8, wherein the second legally-definedgeographic area and third legally-defined geographic area are adjacentto the first legally-defined geographic area.
 10. The method of claim 8,wherein the first and second lists of geographically-prohibited datathat is restricted from being cached in the second and thirdlegally-defined geographic area comprises a prohibited class of data.11. The method of claim 8, wherein the first and second lists ofgeographically-prohibited data that is restricted from being cached inthe second and third legally-defined geographic area comprises aprohibited instance of data.
 12. The method of claim 8, furthercomprising the first balloon receiving the first and second lists ofgeographically-prohibited data from a ground-based station that isassociated with the first legally-defined geographic area.
 13. Themethod of claim 8, further comprising the first balloon receiving thefirst and second lists of geographically-prohibited data from the secondballoon.
 14. A non-transitory computer readable medium storinginstructions that, when executed by one or more processors in acomputing device, cause that computing device to perform functions, thefunctions comprising: while a first balloon is at a location within afirst legally-defined geographic area, accessing a first list ofgeographically-prohibited data that identifies data that is restrictedfrom being cached by the first balloon while the first balloon is at thelocation within the first legally-defined geographic area, wherein thefirst balloon is part of a balloon network including a plurality ofmoveable balloons that provide service to client devices in a pluralityof legally-defined geographic areas; determining that the first balloonhas moved from the first legally-defined geographic area to a locationwithin a second legally-defined geographic area; in response todetermining that the first balloon has moved to the location within thesecond legally-defined geographic area, the first balloon refrainingfrom accessing the first list of geographically-prohibited data andinstead accessing a second list of geographically-prohibited data thatidentifies data that is restricted from being cached by the firstballoon while the first balloon is at the location within the secondlegally-defined geographic area, wherein the second list ofgeographically-prohibited data further indicatesgeographically-prohibited data for each of one or more additionallegally-defined geographic areas; while the first balloon is at thelocation within the second legally-defined geographic area, the firstballoon receiving data; using the second list ofgeographically-prohibited data to determine that the received data isgeographically-prohibited data in the second legally-defined geographicarea; and responsive to a determination that the received data isgeographically-prohibited data in the second legally-defined geographicarea, (i) identifying a second balloon of the plurality of balloons thatis at a location outside of the second legally-defined geographic area,(ii) using the second list of geographically-prohibited data todetermine that the received data is not geographically-prohibited at thelocation of the second balloon, (iii) routing the received data to thesecond balloon, and (iv) refraining from caching the received data indata storage at the first balloon while the first balloon is at thelocation within the second legally-defined geographic area.
 15. Thenon-transitory computer readable medium of claim 14, the functionsfurther comprising: the first balloon receiving the first list ofgeographically-prohibited data from a first ground-based station that isassociated with the first legally-defined geographic area; and the firstballoon receiving the second list of geographically-prohibited data froma second ground-based station that is associated with the secondlegally-defined geographic area.
 16. The non-transitory computerreadable medium of claim 14, the functions further comprising the firstballoon receiving the first and second lists ofgeographically-prohibited data from the second balloon.
 17. A ballooncomprising: a location determination system configured to determine alocation of the balloon; a communication interface configured to receivedata; and a control system configured to: while the balloon is at alocation within a first legally-defined geographic area, access a firstlist of geographically-prohibited data that identifies data that isrestricted from being cached by the first balloon while the firstballoon is at the location within the first legally-defined geographicarea, wherein the first balloon is part of a balloon network including aplurality of moveable balloons that provide service to client devices ina plurality of legally-defined geographic areas; determine that thelocation of the balloon has moved from the first legally-definedgeographic area to a location within a second legally-defined geographicarea; in response to determining that the balloon has moved to thelocation within the second legally-defined geographic area, refrain fromaccessing the first list of geographically-prohibited data and insteadaccess a second list of geographically-prohibited data that identifiesdata that is restricted from being cached by the balloon while theballoon is at the location within the second legally-defined geographicarea, wherein the second list of geographically-prohibited data furtherindicates geographically-prohibited data for each of one or moreadditional legally-defined geographic areas; in response to receivingdata via the communication interface while the balloon is at thelocation within the second legally-defined geographic area, use thesecond list of geographically-prohibited data to determine that thereceived data is geographically-prohibited data in the secondlegally-defined geographic area; and responsive to a determination thatthe received data is geographically-prohibited data in the secondlegally-defined geographic area, (i) identify a second balloon of theplurality of balloons that is at a location outside of the secondlegally-defined geographic area, (ii) use the second list ofgeographically-prohibited data to determine that the received data isnot geographically-prohibited at the location of the second balloon,(iii) route the received data to the second balloon, and (iv) refrainfrom caching the received data in data storage at the first balloonwhile the first balloon is at the location within the secondlegally-defined geographic area.
 18. The balloon of claim 17, whereinthe balloon is a first balloon, and wherein the second list ofgeographically-prohibited data further indicatesgeographically-restricted data that must not be removed from the secondlegally-defined geographic area, wherein the control system is furtherconfigured to: determine that the first balloon contains at least someof the geographically-restricted data; detect when the first balloon islikely to move out of the second legally-defined geographic area; andwhen the first balloon is likely to move out of the secondlegally-defined geographic area, responsively remove thegeographically-restricted data from the memory of the first balloon. 19.The balloon of claim 18, wherein the second list ofgeographically-prohibited data further indicatesgeographically-restricted data that must be saved in at least onelocation in the second legally-defined geographic area, wherein thecontrol system is further configured to: determine if a second balloonlocated in the second legally-defined geographic area contains thegeographically-restricted data; responsive to the determination that thesecond balloon does not include the geographically-restricted data,transfer the geographically-restricted data from the first balloon to adevice that is located in the second legally-defined geographic area,before removing the geographically-restricted data from the memory ofthe first balloon.
 20. A balloon comprising: a location determinationsystem configured to determine a location of the balloon; acommunication interface configured to receive data; and a control systemconfigured to: determine that the location of the balloon has moved fromoutside of a first legally-defined geographic area to a location withinthe first legally-defined geographic area, wherein the balloon is partof a balloon network including a plurality of moveable balloons thatprovide service to client devices in a plurality of legally-definedgeographic areas; in response to determining that the balloon has movedto the location within the first legally-defined geographic area,access: (i) a first list of geographically-prohibited data thatidentifies data that is restricted from being cached in a secondlegally-defined geographic area, and (ii) a second list ofgeographically-prohibited data that identifies data that is restrictedfrom being cached in a third legally-defined geographic area; inresponse to receiving data via the communication interface while theballoon is at the location within the first legally-defined geographicarea, use the first list of geographically-prohibited data and thesecond list of geographically-prohibited data as a basis for making adetermination as to whether or not the received data isgeographically-prohibited data in the second legally-defined geographicarea but not geographically-prohibited data in the third legally-definedgeographic area; and based on the determination that the received datais geographically-prohibited data in the second legally-definedgeographic area but not geographically-prohibited data in the thirdlegally-defined geographic area, (i) identify a second balloon of theplurality of balloons that is at a location within the thirdlegally-defined geographic area, and (ii) route the received datatowards the second balloon.
 21. The balloon of claim 20, wherein theballoon is a first balloon, and wherein the second list ofgeographically-prohibited data further indicatesgeographically-restricted data that must not be removed from the firstlegally-defined geographic area, wherein the control system is furtherconfigured to: determine that the first balloon contains at least someof the geographically-restricted data; detect when the first balloon islikely to move out of the first legally-defined geographic area; andwhen the first balloon is likely to move out of the firstlegally-defined geographic area, responsively remove thegeographically-restricted data from the memory of the first balloon. 22.The balloon of claim 21, wherein the second list ofgeographically-prohibited data further indicatesgeographically-restricted data that must be saved in at least onelocation in the first legally-defined geographic area, wherein thecontrol system is further configured to: determine if a second balloonlocated in the first legally-defined geographic area contains thegeographically-restricted data; responsive to the determination that thesecond balloon does not include the geographically-restricted data,transfer the geographically-restricted data from the first balloon to adevice that is located in the first legally-defined geographic area,before removing the geographically-restricted data from the memory ofthe first balloon.